In today’s IT threat landscape, the attacker might just as easily be over the cubicle wall as in another country. In the past, organizations have been content to use a trust and verify approach to information security, but that’s not working as threats from malicious insiders represent the most risk to organizations. Listen in as John Kindervag, Forrester Senior Analyst, explains why it’s not working and what you can do to address this IT security shortcoming. In this webcast, you’ll hear: Examples of major data breaches that originated from within the organization Why it’s cheaper to invest in proactive breach prevention—even when the organization hasn’t been breached What’s broken about the traditional trust and verify model of information security About a new model for information security that works—the zero-trust model Immediate and long-term activities to move organizations from the "trust and verify" model to the "verify and never trust" model

1. The Zero Trust Model
of Information Security

2. John Kindervag
Forrester Research
Cindy Valladares
Tripwire, Inc.

3. Today’s Speakers
Senior Analyst

4. No More Chewy Centers: The Zero-Trust
Model Of Information Security
John Kindervag, Senior Analyst
4 © 2010 Forrester Research, Inc. Reproduction Prohibited
2009

5. Agenda
New threat landscape
Something’s broken
New trust models
Summary
5 © 2010 Forrester Research, Inc. Reproduction Prohibited

6. Agenda
New threat landscape
Something’s broken
New trust models
Summary
6 © 2010 Forrester Research, Inc. Reproduction Prohibited

7. What do they have in common?
7 © 2010 Forrester Research, Inc. Reproduction Prohibited

8. New threat landscape
 Question: “Why do you rob banks?”
 Answer: “Because that’s where the
money is.”
8 © 2010 Forrester Research, Inc. Reproduction Prohibited

9. Where the money is . . .
 Credit card theft
 Identity theft/fraud
 SPAM/botnets
 Web 2.0 (user-generated content)
9 © 2010 Forrester Research, Inc. Reproduction Prohibited

10. The “Philip Cummings” problem
 Philip Cummings was a help desk staffer at TeleData
Communication, Inc. (TCI), 1999 to 2000.
 TCI is a software provider for credit bureaus such as
Experian and Equifax.
 Cummings had access to client passwords and subscription
codes.
10 © 2010 Forrester Research, Inc. Reproduction Prohibited

11. The “Philip Cummings” problem (cont.)
 Cummings was offered $60 per credit report by Nigerian
nationals (organized crime).
 Cummings provided a laptop preprogrammed to download
credit reports from Experian, Equifax, and TransUnion.
 The crimes took place between 2000 and 2003 (Cummings
left his job in 2000).
11 © 2010 Forrester Research, Inc. Reproduction Prohibited

12. The “Philip Cummings” problem (cont.)
 Discovered by Ford Motor Credit Company in 2003
 30,000 identities stolen
 At least $2.7 million loss (FBI data)
 Cummings sentenced to 14 years in prison and $1 million
fine
 Biggest identity theft in US history
12 © 2010 Forrester Research, Inc. Reproduction Prohibited

13. 13 © 2010 Forrester Research, Inc. Reproduction Prohibited

14. 14 © 2010 Forrester Research, Inc. Reproduction Prohibited

15. Agenda
New threat landscape
Something’s broken
New trust models
Summary
Other item
15 © 2010 Forrester Research, Inc. Reproduction Prohibited

16. Plenty of controls
Home Users Internet
Business Parters
Remote
Wireless
Users IDS Tap
Router
Firewall
IPSEC VPN
SSL VPN
Two-Factor Switch IDS Tap Web Application
Authentication Firewall
Web Server Farm
IDS Tap
Patch
RNA Console
Management IDS Tap IDS Tap
Content
Filtering
FTP Server Email Server
Intrusion Security
Switch
Detection Information Server DMZ
Console Manager
Switch
Wireless Gateway
Wireless
Anti-Virus
Management
Console IDS Tap
Console
Internal Users
Management Segment
Corporate Wireless
Network
Internal Server Farm
16 © 2010 Forrester Research, Inc. Reproduction Prohibited

17. What’s broken?
17 © 2010 Forrester Research, Inc. Reproduction Prohibited

18. Which one goes to the Internet?
UNTRUSTED TRUSTED
18 © 2010 Forrester Research, Inc. Reproduction Prohibited

19. “Trust but verify?”
19 © 2010 Forrester Research, Inc. Reproduction Prohibited

20. What’s broken?
Trust model
20 © 2010 Forrester Research, Inc. Reproduction Prohibited

21. 2010 breaches — malicious insider
21 © 2010 Forrester Research, Inc. Reproduction Prohibited

22. The cost of a breach
Source: April 10, 2007, “Calculating The Cost Of A Security Breach” Forrester report
22 © 2010 Forrester Research, Inc. Reproduction Prohibited

23. TJX accrued expenses (10k) — 2008
Source: January 11, 2010, “PCI Unleashed” Forrester report
23 © 2010 Forrester Research, Inc. Reproduction Prohibited

24. How do we fix it?
24 © 2010 Forrester Research, Inc. Reproduction Prohibited

25. Agenda
New threat landscape
Something’s broken
New trust models
Summary
25 © 2010 Forrester Research, Inc. Reproduction Prohibited

26. Zero trust
UNTRUSTED UNTRUSTED
26 © 2010 Forrester Research, Inc. Reproduction Prohibited

27. Concepts of zero trust
 All resources are accessed in a secure manner, regardless of location.
 Access control is on a “need-to-know” basis and is strictly enforced.
 Verify and never trust.
 Inspect and log all traffic.
 The network is designed from the inside out.
27 © 2010 Forrester Research, Inc. Reproduction Prohibited

28. Inspect and log everything
IPS
WAF IPS
Web IPS Server
farm farm
WLAN
GW
IPS DAM
DB farm
IPS
SIM NAV MGMT
DAN server
WAN
28 © 2010 Forrester Research, Inc. Reproduction Prohibited

29. 29 © 2010 Forrester Research, Inc. Reproduction Prohibited

30. 30 © 2010 Forrester Research, Inc. Reproduction Prohibited

31. Agenda
New threat landscape
Something’s broken
New trust models
Summary
31 © 2010 Forrester Research, Inc. Reproduction Prohibited

32. Strong perimeters = new threat vectors
 The threat landscape is changing — beyond the perimeter.
 Organized crime is bribing insiders.
 Security must become ubiquitous throughout your infrastructure.
32 © 2010 Forrester Research, Inc. Reproduction Prohibited

33. Recommendations
 New paradigm — data-centric security
 Zero trust — “Verify, but don’t trust!”
 Inspect and log all traffic.
 Design with compliance in mind.
33 © 2010 Forrester Research, Inc. Reproduction Prohibited

34. A blueprint for making it real
The next 90 days
• Eliminate the word “trust” from your vocabulary.
• Find your critical data, and map your data flows.
• Tell people you will be watching their data access
activity.
• Review who should be allowed specific data access.
34 34 contents © 2010 Forrester Research,Reproduction Prohibited
Entire © 2010 Forrester Research, Inc. Inc. All rights reserved.

35. A blueprint for making it real
Longer term
• Create a data acquisition network (DAN).
• Segment your network to ease your security and
compliance burden.
• Begin rebuilding your network to reflect the zero-trust
concepts.
35 35 contents © 2010 Forrester Research,Reproduction Prohibited
Entire © 2010 Forrester Research, Inc. Inc. All rights reserved.

36. Thank you
John Kindervag
+1 469.221.5372
jkindervag@forrester.com
Twitter: @Kindervag
www.forrester.com
© 2009 Forrester Research, Inc. Reproduction Prohibited

37. John Kindervag
www.tripwire.com
Forrester Research
E-mail : jkindervag@forrester.com